Index
+ +
+
+
+
+
+
+
+
+
+ ' + + '' + + _("Hide Search Matches") + + "
" + ) + ); + }, + + /** + * helper function to hide the search marks again + */ + hideSearchWords: () => { + document + .querySelectorAll("#searchbox .highlight-link") + .forEach((el) => el.remove()); + document + .querySelectorAll("span.highlighted") + .forEach((el) => el.classList.remove("highlighted")); + localStorage.removeItem("sphinx_highlight_terms") + }, + + initEscapeListener: () => { + // only install a listener if it is really needed + if (!DOCUMENTATION_OPTIONS.ENABLE_SEARCH_SHORTCUTS) return; + + document.addEventListener("keydown", (event) => { + // bail for input elements + if (BLACKLISTED_KEY_CONTROL_ELEMENTS.has(document.activeElement.tagName)) return; + // bail with special keys + if (event.shiftKey || event.altKey || event.ctrlKey || event.metaKey) return; + if (DOCUMENTATION_OPTIONS.ENABLE_SEARCH_SHORTCUTS && (event.key === "Escape")) { + SphinxHighlight.hideSearchWords(); + event.preventDefault(); + } + }); + }, +}; + +_ready(() => { + /* Do not call highlightSearchWords() when we are on the search page. + * It will highlight words from the *previous* search query. + */ + if (typeof Search === "undefined") SphinxHighlight.highlightSearchWords(); + SphinxHighlight.initEscapeListener(); +}); diff --git a/_static/workbench-v2-logo.svg b/_static/workbench-v2-logo.svg new file mode 100644 index 00000000..fb4dd716 --- /dev/null +++ b/_static/workbench-v2-logo.svg @@ -0,0 +1,5 @@ + diff --git a/genindex.html b/genindex.html new file mode 100644 index 00000000..b33d3d06 --- /dev/null +++ b/genindex.html @@ -0,0 +1,120 @@ + + + + + +
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/guides/admin-guide.html b/guides/admin-guide.html
new file mode 100644
index 00000000..517d4c59
--- /dev/null
+++ b/guides/admin-guide.html
@@ -0,0 +1,421 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/guides/dev-guide.html b/guides/dev-guide.html
new file mode 100644
index 00000000..08583819
--- /dev/null
+++ b/guides/dev-guide.html
@@ -0,0 +1,220 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Admin Guide
+ +Cluster Requirements
+The following third-party dependencies are required. These can optionally be installed by our Helm chart if they are not alrady provided on your cluster:
+-
+
- + +
- + +
- +
- +
- +
The following third-party dependencies are optional, but recommended:
+-
+
CertManager: for automating renewal of Wildcard TLS certificates
+
Workbench Deployment Steps
+The following steps can be used to deploy Workbench to any cluster where you have kubeconfig access.
+For local development, we offer a Makefile to help get everything up and running in the proper order
+For production deployments, we recommend setting up your own custom Helm Configuration values
+Local Development Instance
+To contribute back to the Workbench platform, you can run a local development environment in a few quick steps
+Prerequisites:
+-
+
make CLI
+Git CLI
+- +
- +
- +
Make sure no other application is running on port 80/443
+
Setup Steps:
+-
+
-
+
- Enable Kubernetes in Docker Desktop
-
+
This will run a small Kubernetes cluster on your local machine
+
+
+-
+
- Clone the workbench-helm-chart repo locally
-
+
git clone https://github.com/nds-org/workbench-helm-chart && cd workbench-helm-chart/
+
+
+-
+
- Edit the .env to setup your local config. The defaults should work as-is, but you may need to change the following:
-
+
KUBE_CONTEXT=docker-desktop the Kubernetes kubeconfig context to use. This should match the name of a context from kubectl config get-contexts file. See Kubernetes Documentation for more details
+NAMESPACE=workbench the Kubernetes namespace where Workbench will run
+NAME=workbench the name of the Helm release that will run Workbench
+
+
+-
+
- Run make dev to install all parts of the application. This will automatically do the following:
-
+
Verify that all dependencies are installed correctly
+Update/fetch Helm dependency charts
+Clone the webui/apiserver source code locally
+Install frontend dependencies and use them to compile the source code
+(if REALM_IMPORT=true) Create a configmap called keycloak-realm - this will automatically create a Keycloak realm named workbench-dev with all necessary groups and mappings
+Deploy the Workbench Helm chart (with live-reload) with dependencies
+Pull and run all required Docker images and bring the platform online
+
+
+-
+
- Run make status to verify that everything is starting up properly. You can also run make watch to watch for changes
-
+
Wait until all Volumes are Bound and all Pods are Running
+
+
+-
+
- Navigate your browser to https://kubernetes.docker.internal
-
+
You should see the Workbench Landing page load in your browser
+
+
+Click the Login button to go to the Keycloak login page
+Click the Register button at the bottom and create a Test User
+
After registraton, you should now be logged into the Workbench WebUI
+Testing the Workbench API
+If you’re modifying the Workbench API, it can be helpful to test your changes using Swagger UI +This lets you test the API’s raw request/reponse behavior without involving or changing the WebUI
+To see Swagger UI, go to https://kubernetes.docker.internal/swagger +To use the authenticated endpoints (padlock icon), you can use the POST /authenticate endpoint
+This endpoint takes your Test User username/password combination, and returns a token when successful +After authenticating, this token will be automatically added to all requests from Swagger UI
+You can test this by executing the /me endpoint, which should now return information about the currently logged-in user
+Production Deployment
+-
+
Copy values.yaml to create a new file named values.myworkbench.yaml
+-
+
- Edit values.myworkbench.yaml to your liking. Subcharts allow us to set configuration options on them as well. In particular, you may want to change:
-
+
Disable any sub-charts that you don’t want to deploy with Workbench (e.g. NFS server, Keycloak, etc)
+Edit ingress.api.annotations and ingress.webui.annotations to modify the Ingress annotations for the API / WebUI respectively
+Edit config.frontend.customization section to customize the appearance/text of the WebUI
+Edit ingress.hostname and config.backend.domain with your desired domain name
+Edit config.frontend.signin_url, config.frontend.signout_url, and config.backend.oauth.userinfoUrl
+Edit config.backend.namespace and set this to the namespace where your UserApps should launch
+Edit config.backend.mongo section and update/match MongoDB credentials throughout
+Edit config.backend.keycloak section to point at a third-party Keycloak instance
+Edit config.backend.userapps.shared_storage if you want to enable one or more Shared Data Volume
+Edit config.backend.userapps.annotations to modify the Ingress annotations for UserApps
+Edit mongodb.autoimport section to change which github repo is loaded during the import-specs job
+Locate kubernetes.docker.internal throughout and replace with your own domain
+
+
+Change your kubeconfig context to your desired cluster context: kubectl config use-context <name>
+-
+
- Deploy the Helm chart using your custom values: helm upgrade –install –create-namespace -n <namespace> <name> . -f values.myworkbench.yaml
-
+
By default, namespace=workbench and name=workbench - you can use any combination here to deploy multiple different Workbench instances to the same cluster
+
+
+
For a full reference of Helm chart configuration values, see https://github.com/nds-org/workbench-helm-chart
+Keycloak Configuration Options
+If you need to change the configuration of Keycloak, go to https://kubernetes.docker.internal/auth/ +Default credentials: admin / workbench
+After logging in, choose the workbench-dev realm from the dropdown at the top-left
+ +Configuring OIDC
+By default, Keycloak only allows username/password auth. By configuring OIDC, you can allow your users to login to the platform with existing credentials from another system (e.g. GitHub, Google, Azure, etc)
+First, create a new OAuth/OIDC Application within the chosen provider(s) (NOTE: this terminology may vary between providers).
+For example, with CILogon users can fill out https://cilogon.org/oauth2/register to receive these values
+Here, the callback URL will be https://<KEYCLOAKDOMAIN>/auth/realms/<REALM>/broker/<CLIENT>/endpoint
+-
+
KEYCLOAKDOMAIN = Keycloak instance domain name
+REALM = Keycloak realm name
+CLIENT = Keycloak client name (you will create this below)
+
This should provide you with a ClientID + ClientSecret to use.
+In Keycloak, create a new Client for each provider and specify your ClientID + ClientSecret when requested, and also set:
+-
+
First Login Flow = browser
+Valid Redirect URLs = https://<APPDOMAIN>/oauth2/callback
+Default Scopes = openid profile + any other scopes desired
+Set Authorization URL / Token URL / User Info URL / etc according to your chosen provider
+
For a more detailed example of configuring OAuth2 Proxy authentiating via Keycloak, see an example application
+Group Membership
+-
+
workbench-users - allows user to login to Workbench (otherwise 403 is returned)
+workbench-developers - allows user access to create, modify, and launch custom UserApps
+workbench-admin - not currently used. (future: allow user to access admin-only API/UI functions)
+
Using an External Keycloak
+If you already have a running Keycloak instance that you would like to use, make sure you configure Mappers needed for OIDC via OAuth2 Proxy
+For more information, see the OAuth2 Proxy documentation
+Audience
+Configure a dedicated audience mapper for your client by navigating to Clients -> <your client’s id> -> Client scopes.
+-
+
Access the dedicated mappers pane by clicking <your client’s id>-dedicated, located under Assigned client scope.
+
-
+
- (It should have a description of “Dedicated scope and mappers for this client”)
-
+
-
+
- Click Configure a new mapper and select Audience
-
+
Name ‘aud-mapper-<your client’s id>’
+-
+
- Included Client Audience select <your client’s id> from the dropdown.
-
+
OAuth2 proxy can be set up to pass both the access and ID JWT tokens to your upstream services. If you require additional audience entries, you can use the Included Custom Audience field in addition to the “Included Client Audience” dropdown. Note that the “aud” claim of a JWT token should be limited and only specify its intended recipients.
+
+
+Add to ID token ‘On’
+-
+
- Add to access token ‘On’ - #1916
-
+
Save the configuration.
+
+
+
+
+
+
-
+
Any subsequent dedicated client mappers can be defined by clicking Dedicated scopes -> Add mapper -> By configuration -> Select mapper
+
Groups
+To summarize, the steps required to authorize Keycloak group membership with OAuth2 Proxy are as follows:
+-
+
-
+
- Create a new Client Scope with the name groups in Keycloak.
-
+
Include a mapper of type Group Membership.
+Set the “Token Claim Name” to groups or customize by matching it to the –oidc-groups-claim option of OAuth2 Proxy.
+If the “Full group path” option is selected, you need to include a “/” separator in the group names defined in the –allowed-group option of OAuth2 Proxy. Example: “/groupname” or “/groupname/childgroup”.
+
+
+
After creating the Client Scope named groups you will need to attach it to your client. +Clients -> <your client’s id> -> Client scopes -> Add client scope -> Select groups and choose Optional and you should now have a client that maps group memberships into the JWT tokens so that Oauth2 Proxy may evaluate them.
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/guides/user-guide.html b/guides/user-guide.html
new file mode 100644
index 00000000..62c3c296
--- /dev/null
+++ b/guides/user-guide.html
@@ -0,0 +1,229 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Contributor Guide
+ +Contributors and Developers in the system have access to some special functionality.
+To access the following features, ask your administrator to add you to the workbench-developers group in Keycloak.
+View: All Apps
+Contributors have the ability to “Clone” a spec from the All Apps view
+This will create a copy of the app on the “My Catalog” so that it can be edited or extended
+
+View: My Apps
+Contributors have the ability to “Edit” envvars for an App instance in the “My Apps” view
+This allows you to set/override custom Environment Variables before launching the app
+
+View: My Catalog
+Most importantly, only developers have access to a custom “My Catalog” view.
+This allows contributors to see their created/cloned applications and edit the spec directly.
+After editing the spec, the App will be displayed in your All Apps view, but will not yet be shown to other users.
+This allows you to create, modify, and test custom applications
+-
+
-
+
- List all your Catalog applications
-
+
Export JSON spec from Catalog
+Clone App to Catalog
+Edit App in Catalog
+Delete App from Catalog
+
+
+
+-
+
Import JSON spec to Catalog
+
+Create / Edit App in Catalog +* Key (required) / Label (optional) +* Display: stack / service / none +* Access : external / internal / none +* Docker Image Metadata
++++
+- +
Single repo / image name
- +
List of offered tags
- +
Command / Args
-
+
Logo / info URLs
+Dependencies
+-
+
- Environment Variables
-
+
Defaults / Overrides
+Passwords
+
+
+-
+
- Ports
-
+
Protocol - TCP / UDP / HTTP(S)
+Port Number
+Path (HTTP only)
+
+
+-
+
- Volumes
-
+
From Path (Host / PVC)
+To Path (inside Container)
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/index.html b/index.html
new file mode 100644
index 00000000..d8c190d4
--- /dev/null
+++ b/index.html
@@ -0,0 +1,200 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ User Guide
+All Workbench users have the ability to install and launch UserApps
+ +Typical User Flow
+A typical user of the app would likely follow these steps:
+-
+
Login to Workbench
+Go to “All Apps” to view all AppSpecs offered by the system
+Find an AppSpec to install, then click the + button
+On the “My Apps” view, your chosen UserApp should now appear
+Click the Launch button on your UserApp to start it up
+Wait for the status to turn green
+Expand the running app - you should see a link appear in the expanded section
+Click the link to navigate to your launched UserApp
+When you’re finished using the app, click the Shutdown button
+Wait for the app to finishing shutting down
+Click the Delete button to remove the UserApp from your list
+
Landing Page
+Depending on how your administrator has configured Workbench, there are two ways to log into the platform: username/password or OIDC
+Typically we recommend configuring some form of OIDC for production instances, but this is not always appropriate.
+Login with Local Username / Password
+
+-
+
User navigates to WebUI and clicks the Login button
+User is sent to the OAuth2 Proxy’s /oauth2/start endpoint
+/oauth2/start begins the OAuth chain, which starts by automatically redirecting the User to Keycloak
+User enters their username / password into the form and clicks “Sign In” at the bottom
+
After login, User is automatically redirected back to the Workbench WebUI with a valid auth token set as a cookie.
+This cookie is automatically sent to the Workbench API server with every subsequent request
+Login with an OIDC Provider (e.g. CILogon)
+
+-
+
User navigates to WebUI and clicks the login button
+User is sent to the OAuth2 Proxy’s /oauth2/start endpoint
+-
+
- /oauth2/start begins the OAuth chain, which starts by automatically redirecting the User to Keycloak
-
+
If ONLY OIDC is enabled (no username/password), you will be redirected to the provider’s login page
+
+
+User logs in with provider credentials
+
After login, User is automatically redirected back to the Workbench WebUI with a valid auth token set as a cookie.
+This cookie is automatically sent to the Workbench API server with every subsequent request
+All Apps
+
+This view shows the entire catalog of our available AppSpecs
+With this view, we can:
+-
+
Search / Filter to find applications that we can create
+Create a New Application Instance - this will create a new item under “My Apps”
+
My Apps
+
+With this view, we can:
+-
+
Launch / Shutdown an Application Instance (App)
+Go to a running application
+Access the Console of Running App
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/install/gke.html b/install/gke.html
new file mode 100644
index 00000000..80562460
--- /dev/null
+++ b/install/gke.html
@@ -0,0 +1,168 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Labs Workbench
+The growing size and complexity of high-value scientific datasets are pushing +the boundaries of traditional models of data access and discovery. Many large +datasets are only accessible through the systems on which they were created or +require specialized software or computational resources.
+Labs Workbench is a scalable, web-based platform intended to support turn-key +deployment of encapsulated data management and analysis tools to support +exploratory analysis and development near research datasets.
+Terminology
+The following collections are stored in MongoDB:
+-
+
AppSpec: Contains all the information needed to create a new UserApp
+UserApp: A launchable instance of an AppSpec that is owned by a particular user
+
+
+Overview
+ +
+
+Platform Usage
+-
+
- User Guide + +
- Contributor Guide + +
- Admin Guide + +
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/install/helm.html b/install/helm.html
new file mode 100644
index 00000000..74d417eb
--- /dev/null
+++ b/install/helm.html
@@ -0,0 +1,145 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Quickstart Install on GKE
+Using the Google Cloud UI or gcloud, create a Kubernetes cluster:
+gcloud container clusters create [CLUSTER_NAME] [--zone [COMPUTE_ZONE]]
+Setup a ClusterRoleBinding for your account:
+gcloud info | grep Account
+Account: [myname@example.org]
+
+kubectl create clusterrolebinding myname-cluster-admin-binding --clusterrole=cluster-admin \
+ --user=myname@example.org
+On the Cloud Console or your local system, install and configure Helm:
+curl https://raw.githubusercontent.com/kubernetes/helm/master/scripts/get | bash
+kubectl --namespace kube-system create serviceaccount tiller
+kubectl create clusterrolebinding tiller --clusterrole cluster-admin \
+ --serviceaccount=kube-system:tiller
+helm init --service-account tiller --wait
+Install the NGINX Ingress Controller:
+helm install --name nginx-ingress stable/nginx-ingress --set rbac.create=true
+Clone the Workbench chart:
+git clone https:/github.com/nds-org/workbench-helm-chart -b gke
+Create an in-cluster NFS server to support ReadWriteMany volume claims:
+cd nfs-example
+kubectl create -f deployment.yaml -f rbac.yaml -f class.yaml
+Configure Workbench values.yaml:
+-
+
Set domain to a wildcard DNS entry. Contact us if you need something (e.g., project.ndslabs.org)
+Set support_email to a valid Gmail account
+Set smtp.gmail_user and smtp.gmail_password to your Gmail account and an app password
+Create a self-signed cert using generate-self-signed-cert.sh <domain> and paste into tls.cert and tls.key sections.
+
Install Workbench chart:
+helm install . --name=workbench --namespace=workbench
+Once the pods are running, you should be able to access your instance at +https://www.project.ndslabs.org). Click “Sign Up” to register an account. With +the default chart settings, you will be required to verify your email address +and the support_email account will receive a message to approve/deny +registration. After approval, login to your account and launch the File +Manager. Confirm that you can access the File Manager UI.
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/install/workbench.html b/install/workbench.html
new file mode 100644
index 00000000..283c5d91
--- /dev/null
+++ b/install/workbench.html
@@ -0,0 +1,194 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Setting up Helm
+Labs Workbench uses the Helm package manager for +Kubernetes. This section describes how to setup Helm on your cluster.
+There a number of ways to install Helm. A simple approach is to +run the Helm installer:
+curl https://raw.githubusercontent.com/kubernetes/helm/master/scripts/get | bash
+This will install the latest release of Helm.
+After installing Helm on your system, you must initialize it in your Kubernetes +cluster:
+First, setup a ServiceAccount for use by the tiller:
+kubectl --namespace kube-system create serviceaccount tiller
+Next, give the ServiceAccount permissions to manage the cluster:
+kubectl create clusterrolebinding tiller --clusterrole cluster-admin \
+ --serviceaccount=kube-system:tiller
+Finally, initialize Helm in your cluster:
+helm init --service-account tiller --wait
+This command creates a tiller deployment in the kube-system namespace and +configures your local helm client.
+For more information, see the Helm +<https://docs.helm.sh/using_helm/#installing-helm>_ documentation.
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/objects.inv b/objects.inv
new file mode 100644
index 00000000..f8c107f2
--- /dev/null
+++ b/objects.inv
@@ -0,0 +1,8 @@
+# Sphinx inventory version 2
+# Project: Labs Workbench
+# Version: develop
+# The remainder of this file is compressed using zlib.
+xڅKO0&ʼn[wfbԨqN\zB'}8BK < {G{{
+&-JSH*rp hMZvu{ =RVAG;Sz 3KBV?\h/qҵ UYwJB+.R V!h){a6}sЕi
+3H
^MhB5͎_ <.!z2>A)UH Г4f3FDB |,X' ?8R8]ƻk,ʚ*(ɸ\4"%xu^Du
+B%.S|mEgb1'o25Zm
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Setting up Workbench
+Labs Workbench uses the Helm package manager for +Kubernetes. This section describes how to install Workbench and +prerequisites on your cluster.
+Before you start
+Labs Workbench has a few prerequisites:
+-
+
Kubernetes cluster (can be Minikube or kubeadm)
+Helm
+ReadWriteMany storage provisioner for home directories
+NGINX ingress load balancer
+Wildcard DNS and TLS certificate
+
Storage Options
+Labs Workbench uses two types of PersistentVolumeClaims:
+-
+
ReadWriteOnce claim for etcd store
+ReadWriteMany claim for user volumes
+
Storage options available to you depend on your cloud provider and Kubernetes +configuration. Since some cloud providers do not support ReadWriteMany storage +options by default, we recommend using a simple NFS provisioner.
+Note, on GKE you’ll need to create a ClusterRoleBinding for your account:
+gcloud info | grep Account
+Account: [myname@example.org]
+
+kubectl create clusterrolebinding you-cluster-admin-binding --clusterrole=cluster-admin \
+ --user=you@gmail.com
+An example is NFS provider is available: +.. code:: bash
+++git clone https:/github.com/nds-org/workbench-helm-chart +cd nfs-example +kubectl create -f deployment.yaml -f rbac.yaml -f class.yaml
+
This creates an nfs storage class backed by an nfs-provisioner. The +provisioner itself uses a ReadWriteOnce volume from the cloud provider’s +default storage class.
+Installing the NGINX Ingress Controller
+Labs Workbench uses the NGINX Ingress Controller in both OpenStack and GKE +deployments. To install it:
+helm install --name nginx-ingress stable/nginx-ingress --set rbac.create=true
+Installing Labs Workbench
+Now we’re ready to install Labs Workbench:
+git clone https://github.com/nds-org/workbench-helm-chart
+cd workbench-helm-chart/
+You’ll need to edit a few of the settings in values.yaml:
+-
+
domain: Base domain for wildcard DNS (e.g., workbench.ndslabs.org)
+email_address: Email address used as from address in outgoing emails
+Wildcard TLS certificate: Self-signed or valid wildcard certificate for domain
+smtp: In-cluster SMTP server or Gmail username/app password
+
And deploy the chart: +.. code:
+helm install . --name=workbench --namespace=workbench --wait
+If you change your configuration, you can upgrade the chart: +.. code:
+helm upgrade workbench .
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/overview/terminology.html b/overview/terminology.html
new file mode 100644
index 00000000..235a254f
--- /dev/null
+++ b/overview/terminology.html
@@ -0,0 +1,128 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Architecture
+The following diagram illustrates the approximate architecture of the Workbench application:
+
+Components
+-
+
-
+
- NDS Labs Workbench
-
+
- +
-
+
- Workbench Helm Chart
-
+
-
+
- Workbench WebUI (React)
-
+
Swagger UI
+Redux Store
+Websocket use for Console Exec
+
+
+-
+
- Workbench API server (Python)
-
+
KubeWatcher
+Websocket forwarding for Console Exec
+
+
+- + +
+
+
+
+
What is an AppSpec?
+An application specification (AppSpec) contains all of the information necessary to run a containerized application
+The only required pieces are as follows: +* key` is simply unique identifier for this application. This field may only contain alphanumeric characters (no special characters) +* Docker image name/tags of the application
+What is a UserApp?
+The information in the AppSpec is used to create a user-specific instance of an app (UserApp)
+Creating a UserApp creates the following resources on the Kubernetes cluster:
+-
+
ConfigMap (future: secret?) - environment variables for the application to use at runtime
+Ingress (optional) - allows users on the public internet to reach this application
+Service (optional) - allows other applications in the cluster to reach this application
+-
+
- Deployment - Allows us to scale up (launch) or scale down (shutdown) the application while preserving the configuration
-
+
Mount: Home Data Volume PVC - each User has a Home volume that will be mounted in the /home/ folder
+Mount: Shared Data Volume PVC (optional) - if configured, Workbench will mount one or more shared data volumes
+
+
+
Full Authentication Flow
+The auth flow presented here is fairly standard, and works with any app or apps that can make an HTTP request with credentials / cookies.
+Acquiring a Valid Auth Token
+-
+
User navigates to WebUI and clicks the Login button
+User is sent to the OAuth2 Proxy’s /oauth2/start endpoint
+-
+
- /oauth2/start begins the OAuth chain, which starts by automatically redirecting the User to Keycloak
-
+
If local accounts are enabled, you should see a Username/Password field
+If one or more OIDC providers are configured, you should also see a button allowing you to login with those providers (e.g. GitHub, Google, CILogon, etc)
+If ONLY OIDC is enabled, you will be redirected to the provider’s login page
+
+
+(optional) if using OIDC, User logs in with provider credentials
+After login, User is automatically redirected back to Keycloak’s callback URL
+Keycloak sets a few cookies in the User’s browser before automatically redirects the user back to OAuth2 Proxy’s callback URL
+OAuth2 Proxy sets an _oauth2_proxy cookie in the User’s browser containing an authorization token
+OAuth2 Proxy automatically redirects the User back to the Workbench WebUI
+
Finally, the User arrives back at the Workbench WebUI with a valid auth token set as a cookie. This cookie is sent to the Workbench API server with every subsequent request
+Decoding the Auth Token
+Anytime the WebUI or API server needs to decode this token, they can make a request to the /oauth2/userinfo endpoint that includes the token cookie.
+The server will respond with a decoded token as a JSON document
+The decoded token includes the following information: +* email +* username +* group membership
+NGINX / Traefik Integrations
+TODO: add more details here
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/overview/use-cases.html b/overview/use-cases.html
new file mode 100644
index 00000000..926a0db1
--- /dev/null
+++ b/overview/use-cases.html
@@ -0,0 +1,228 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Terminology
+The following collections are stored in MongoDB:
+-
+
AppSpec: Contains all the information needed to create a new UserApp
+UserApp: A launchable instance of an AppSpec that is owned by a particular user
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/search.html b/search.html
new file mode 100644
index 00000000..f4634ade
--- /dev/null
+++ b/search.html
@@ -0,0 +1,134 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Use Cases
+Workbench has been used in various different workshops, classes, and environments to provide quick access to runnable app instances with access to real project data for further analysis
+Name |
+Type |
+Description |
+Tools |
+Status |
+
|---|---|---|---|---|
IASSIST 2016 Odum Workshop |
+Educational Support |
+Odum Institute workshop at IASSIST to provide hands-on experience integrating Dataverse with iRODS. |
+Dataverse, iRODS Cloudbrowser, iRODS iCAT PostgreSQL, TwoRavens |
+Workshop held on May 31, 2016, 27 registered/active users |
+
NDSC6 Hack Day |
+Educational Support |
+NDS Docker tutorial |
+All Tools |
+Workshop held on October 19, 2016, 20 active users |
+
Phenome 2017 |
+Educational Support |
+TERRA-REF workshop demonstrating use of custom Jupyter/Rstudio environments to analyze data products. |
+Cloud9 Python environment for pyClowder, Docker, File Manager, Hyperspectral/NCO, Jupyter/NetCDF4, Jupyter/PlantCV, JupyterLab for pyClowder, RStudio Geospatial, RStudio Server |
+Workshop held on February 10, 2017, 53 registered users 23 active users |
+
University of Washington iSchool Pilot |
+Educational Support |
+Application of Labs Workbench as sandbox for iSchool Data Curation curriculum allowing students to launch private instances of data management services such as DSpace, Dataverse, etc. |
+CKAN, Dataverse, FIDO, SQL Workbench, Oxygen, EIS Archiver, … |
+Spring 2017, INF598H - Advanced Data Curation |
+
EarthCube |
+Data Analysis Tools |
+Serve as a resource to increase exposure and allow others to utilize EarthCube Building Blocks software/services. |
+CINERGI, SuAVE, GeoDeepDive, OntoSoft, GeoWS, … |
+EarthCube 2017 All Hands Meeting, June 7 - June 9 2017 |
+
PI4 Bootcamp |
+Data Analysis Tools |
+Used for two-week course on the use and analysis of large and complex data based on the TERRA-REF dataset. |
+Jupyter, NetCDF4, PlantCV, OpenRefine, RStudio |
+Ran May 26 - June 9, 2017, 30 students participating |
+
2017 American Einstein Toolkit School + Workshop |
+Educational Support |
+Used initially for 2-day workshop and evolved into NDS pilot project supporting ongoing access |
+Jupyter/Einstein Toolkit |
+Ran August 3 - 4 2017, 30 participants. Pilot service used by 40+ users |
+
ThinkChicago 2017 |
+Educational Support |
+Three day hackathon exploring novel tools addressing city of chicago data centric challenges. |
+Cloud9, Jupyter, RStudio, PHP, MongoDB, Postgres, … |
+Ran August 2 - August 4, 2017, 200 participants |
+
DataDrivenAg 2017 |
+Educational Support |
+Two-day hackathon as part of workshop on big-data approaches to agricultural research in cooperation with TERRA-REF |
+Cloud9, Jupyter, RStudio, Globus Personal Connect, PostgresSQL Studio, and Xpra/OpenBox for desktop apps. Also includes fileserver with over 2TB of sample data, data made available via Geoserver WMS/WCS/WFS, and BETYdb PostGIS database. |
+February 26 - February 27, ~80 participants |
+
TERRA-REF |
+Data Analysis Tools |
+Labs Workbench platform is being extended to replace current “Tool Launcher” service to enable broader container-based analysis of TERRA-REF data. |
+Jupyter, NetCDF4, PlantCV, OpenRefine, RStudio |
+Project concluded, Workbench still running and accessible |
+
Cyber-Human Ecosystem for Engaged Security Education (CHEESE) |
+Educational Support |
+Workbench instance customized with educational cybersecurity lesson plans |
+Jupyter + custom apps based on lesson plan |
+Active 2019-2024, Workbench still running and accessible |
+
Permafrost Discovery Gateway (PDG) Workbench |
+Data Analysis Tools |
+Platform enabling analysis of permafrost data made available by other parts of the platform using the toolset offered by the Workbench |
+All Tools |
+Active 2022-present, Workbench still running and accessible |
+
Metabolomics Workbench |
+Data Analysis Tools |
+Platform enabling analysis of metabolomic data made available by other parts of the platform using the toolset offered by the Workbench |
+All Tools |
+Active 2021-present, Workbench still running and accessible |
+
AMR Dashboard/Workbench |
+Data Analysis Tools |
+Platform enabling analysis of anti-microbial data made available by other parts of the platform using the toolset offered by the Workbench |
+Jupyter, RStudio, … |
+Pending |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/searchindex.js b/searchindex.js
new file mode 100644
index 00000000..8524d41c
--- /dev/null
+++ b/searchindex.js
@@ -0,0 +1 @@
+Search.setIndex({"docnames": ["guides/admin-guide", "guides/dev-guide", "guides/user-guide", "index", "install/gke", "install/helm", "install/workbench", "overview/architecture", "overview/terminology", "overview/use-cases"], "filenames": ["guides/admin-guide.rst", "guides/dev-guide.rst", "guides/user-guide.rst", "index.rst", "install/gke.rst", "install/helm.rst", "install/workbench.rst", "overview/architecture.rst", "overview/terminology.rst", "overview/use-cases.rst"], "titles": ["Admin Guide", "Contributor Guide", "User Guide", "Labs Workbench", "Quickstart Install on GKE", "Setting up Helm", "Setting up Workbench", "Architecture", "Terminology", "Use Cases"], "terms": {"The": [0, 3, 6, 7, 8], "follow": [0, 1, 2, 3, 7, 8], "third": [0, 7], "parti": [0, 7], "depend": [0, 1, 2, 6, 7], "ar": [0, 2, 3, 4, 7, 8], "These": 0, "can": [0, 1, 2, 4, 6, 7], "instal": [0, 2, 5], "our": [0, 2], "helm": [0, 4, 6, 7], "chart": [0, 4, 6, 7], "thei": [0, 3, 7], "alradi": 0, "provid": [0, 3, 6, 7, 9], "your": [0, 1, 2, 4, 5, 6], "nf": [0, 4, 6, 7], "provision": [0, 6, 7], "readwritemani": [0, 4, 6, 7], "server": [0, 2, 4, 6, 7, 9], "client": [0, 5, 7], "other": [0, 1, 7, 9], "rwm": 0, "should": [0, 2, 4, 7], "work": [0, 7], "have": [0, 1, 2], "been": [0, 9], "ingress": [0, 4, 7], "control": [0, 4, 7], "traefik": [0, 3], "nginx": [0, 3, 4], "oauth2": [0, 2, 7], "proxi": [0, 2, 7], "mongodb": [0, 3, 7, 8, 9], "recommend": [0, 2, 6], "certmanag": 0, "autom": 0, "renew": 0, "wildcard": [0, 4, 6], "tl": [0, 4, 6], "certif": [0, 6], "deploi": [0, 6], "ani": [0, 7], "where": 0, "you": [0, 1, 2, 4, 5, 7], "kubeconfig": 0, "access": [0, 1, 2, 3, 4, 9], "For": [0, 5], "we": [0, 2, 6], "offer": [0, 1, 2, 9], "makefil": 0, "help": 0, "get": [0, 4, 5], "everyth": 0, "up": [0, 2, 4, 7], "run": [0, 2, 4, 5, 7, 9], "proper": 0, "order": 0, "set": [0, 1, 2, 4, 7], "own": [0, 3, 8], "custom": [0, 1, 9], "valu": [0, 3, 4, 6], "To": [0, 1, 6], "contribut": 0, "back": [0, 2, 6, 7], "platform": [0, 2, 9], "environ": [0, 1, 7, 9], "few": [0, 6, 7], "quick": [0, 9], "prerequisit": [0, 6], "make": [0, 7], "cli": 0, "git": [0, 4, 6], "nodej": 0, "npm": 0, "docker": [0, 1, 7, 9], "desktop": [0, 9], "sure": 0, "applic": [0, 1, 2, 7, 9], "i": [0, 2, 3, 5, 6, 8, 9], "port": [0, 1], "80": [0, 9], "443": 0, "setup": [0, 4, 5], "enabl": [0, 2, 7, 9], "kubernet": [0, 4, 5, 6, 7], "thi": [0, 1, 2, 5, 6, 7], "small": 0, "machin": 0, "clone": [0, 1, 4, 6], "repo": [0, 1], "http": [0, 1, 4, 5, 6, 7], "github": [0, 4, 6, 7], "com": [0, 4, 5, 6], "nd": [0, 4, 6, 7, 9], "org": [0, 4, 6], "cd": [0, 4, 6], "edit": [0, 1, 6], "env": 0, "config": 0, "default": [0, 1, 4, 6], "mai": [0, 7, 9], "need": [0, 3, 4, 6, 7, 8], "chang": [0, 6], "kube_context": 0, "context": 0, "match": 0, "name": [0, 1, 4, 6, 7, 9], "from": [0, 1, 2, 6], "kubectl": [0, 4, 5, 6], "file": [0, 4, 9], "see": [0, 1, 2, 5, 7], "document": [0, 5, 7], "more": [0, 5, 7], "detail": [0, 7], "namespac": [0, 4, 5, 6], "releas": [0, 5], "dev": 0, "all": [0, 3, 7, 8, 9], "part": [0, 9], "automat": [0, 2, 7], "do": [0, 6], "verifi": [0, 4], "correctli": 0, "updat": 0, "fetch": 0, "webui": [0, 2, 7], "apiserv": 0, "sourc": 0, "code": [0, 6], "frontend": 0, "them": 0, "compil": 0, "realm_import": 0, "true": [0, 4, 6], "creat": [0, 1, 2, 3, 4, 5, 6, 7, 8], "configmap": [0, 7], "call": 0, "realm": 0, "necessari": [0, 7], "map": 0, "live": 0, "reload": 0, "pull": 0, "imag": [0, 1, 7], "bring": 0, "onlin": 0, "statu": [0, 2, 9], "start": [0, 2, 7], "properli": 0, "also": [0, 7, 9], "watch": 0, "wait": [0, 2, 4, 5, 6], "until": 0, "volum": [0, 1, 4, 6, 7], "bound": 0, "pod": [0, 4], "navig": [0, 2, 7], "browser": [0, 7], "intern": [0, 1], "land": [0, 3], "page": [0, 3, 7], "load": [0, 6], "click": [0, 2, 4, 7], "login": [0, 3, 4, 7], "button": [0, 2, 7], "go": [0, 2], "regist": [0, 4, 9], "bottom": [0, 2], "user": [0, 1, 3, 4, 6, 7, 8, 9], "after": [0, 1, 2, 4, 5, 7], "registraton": 0, "now": [0, 2, 6], "log": [0, 2, 7], "If": [0, 2, 6, 7], "re": [0, 2, 6], "modifi": [0, 1], "swagger": [0, 7], "ui": [0, 4, 7], "let": 0, "": [0, 1, 2, 6, 7], "raw": [0, 4, 5], "request": [0, 2, 7], "repons": 0, "behavior": 0, "without": 0, "involv": 0, "authent": [0, 3], "endpoint": [0, 2, 7], "padlock": 0, "icon": 0, "post": 0, "take": 0, "usernam": [0, 3, 6, 7], "password": [0, 1, 3, 4, 6, 7], "combin": 0, "return": 0, "token": [0, 2, 3], "when": [0, 2], "success": 0, "ad": 0, "execut": 0, "me": 0, "which": [0, 2, 3, 7], "inform": [0, 3, 5, 7, 8], "about": 0, "current": [0, 9], "copi": [0, 1], "yaml": [0, 4, 6], "new": [0, 2, 3, 8], "myworkbench": 0, "like": [0, 2], "subchart": 0, "allow": [0, 1, 7, 9], "u": [0, 4, 7], "well": 0, "In": [0, 2, 6], "particular": [0, 3, 8], "want": 0, "disabl": 0, "sub": 0, "don": 0, "t": 0, "e": [0, 3, 4, 6, 7], "g": [0, 3, 4, 6, 7], "etc": [0, 7, 9], "annot": 0, "respect": 0, "section": [0, 2, 4, 5, 6], "appear": [0, 2], "text": 0, "hostnam": 0, "backend": 0, "domain": [0, 4, 6], "desir": 0, "signin_url": 0, "signout_url": 0, "oauth": [0, 2, 7], "userinfourl": 0, "userapp": [0, 2, 3, 8], "launch": [0, 1, 2, 4, 7, 9], "mongo": 0, "credenti": [0, 2, 7], "throughout": 0, "point": 0, "shared_storag": 0, "one": [0, 7], "share": [0, 7], "data": [0, 3, 7, 9], "autoimport": 0, "dure": 0, "import": [0, 1], "spec": [0, 1, 7], "job": 0, "locat": 0, "replac": [0, 9], "upgrad": [0, 6], "n": 0, "f": [0, 4, 6], "By": 0, "here": [0, 7], "multipl": 0, "differ": [0, 9], "same": 0, "full": [0, 3], "refer": 0, "auth": [0, 2, 3], "choos": 0, "dropdown": 0, "top": 0, "left": 0, "via": [0, 9], "first": [0, 5], "broker": 0, "sent": [0, 2, 7], "through": [0, 3], "although": 0, "most": [0, 1], "built": 0, "veri": 0, "nice": 0, "addit": 0, "modif": 0, "some": [0, 1, 2, 6], "exampl": [0, 4, 6], "tell": 0, "how": [0, 2, 5, 6], "redirect": [0, 2, 7], "skip": 0, "kecloak": 0, "what": [0, 3], "happen": 0, "time": 0, "merg": 0, "exist": 0, "account": [0, 4, 5, 6, 7], "email": [0, 4, 6, 7], "onli": [0, 1, 2, 3, 7], "anoth": 0, "system": [0, 1, 2, 3, 4, 5], "googl": [0, 4, 7], "azur": 0, "within": 0, "chosen": [0, 2], "note": [0, 6], "terminologi": 0, "vari": 0, "between": 0, "cilogon": [0, 3, 7], "fill": 0, "out": 0, "receiv": [0, 4], "callback": [0, 7], "url": [0, 1, 7], "keycloakdomain": 0, "below": 0, "clientid": 0, "clientsecret": 0, "each": [0, 7], "specifi": 0, "valid": [0, 2, 3, 4, 6], "appdomain": 0, "scope": 0, "openid": 0, "profil": 0, "info": [0, 1, 4, 6], "accord": 0, "authenti": 0, "otherwis": 0, "403": 0, "futur": [0, 7], "function": [0, 1], "alreadi": 0, "would": [0, 2], "mapper": 0, "dedic": 0, "id": 0, "pane": 0, "under": [0, 2], "assign": 0, "It": 0, "descript": [0, 9], "select": 0, "aud": 0, "includ": [0, 7, 9], "pass": 0, "both": [0, 6], "jwt": 0, "upstream": 0, "servic": [0, 1, 4, 5, 7, 9], "entri": [0, 4], "field": [0, 7], "claim": [0, 4, 6], "limit": 0, "its": 0, "intend": [0, 3], "recipi": 0, "add": [0, 1, 7], "On": [0, 2, 4], "1916": 0, "save": 0, "subsequ": [0, 2, 7], "defin": 0, "summar": 0, "type": [0, 6, 9], "path": [0, 1], "separ": 0, "groupnam": 0, "childgroup": 0, "attach": 0, "so": [0, 1], "evalu": 0, "develop": [1, 3], "special": [1, 3, 7], "featur": 1, "ask": 1, "administr": [1, 2], "workbench": [1, 2, 4, 5, 7, 9], "group": [1, 3, 7], "keycloak": [1, 2, 3, 7], "abil": [1, 2], "extend": [1, 9], "envvar": 1, "an": [1, 3, 4, 6, 8], "instanc": [1, 2, 3, 4, 7, 8, 9], "overrid": 1, "variabl": [1, 7], "befor": [1, 7], "importantli": 1, "directli": 1, "displai": 1, "yet": 1, "shown": 1, "test": [1, 3], "list": [1, 2], "export": 1, "json": [1, 7], "delet": [1, 2], "kei": [1, 3, 4, 7], "requir": [1, 3, 4, 7], "label": 1, "option": [1, 3, 7], "stack": 1, "none": 1, "extern": [1, 3], "metadata": 1, "singl": 1, "tag": [1, 7], "command": [1, 5], "arg": 1, "logo": 1, "protocol": 1, "tcp": 1, "udp": 1, "number": [1, 5], "host": 1, "pvc": [1, 7], "insid": 1, "contain": [1, 3, 4, 7, 8, 9], "A": [2, 3, 5, 8], "step": [2, 3], "view": [2, 3], "appspec": [2, 3, 8], "find": 2, "turn": [2, 3], "green": 2, "expand": 2, "link": 2, "finish": 2, "us": [2, 3, 4, 5, 6, 7], "shutdown": [2, 7], "shut": 2, "down": [2, 7], "remov": 2, "ha": [2, 6, 7, 9], "configur": [2, 3, 4, 5, 6, 7], "two": [2, 6, 9], "wai": [2, 5], "form": 2, "product": [2, 3, 9], "alwai": 2, "appropri": 2, "begin": [2, 7], "chain": [2, 7], "enter": 2, "sign": [2, 4, 6], "cooki": [2, 7], "api": [2, 3, 7], "everi": [2, 7], "show": 2, "entir": 2, "catalog": [2, 3, 7], "avail": [2, 6, 9], "With": [2, 4], "search": 2, "filter": 2, "item": 2, "consol": [2, 4, 7], "grow": 3, "size": 3, "complex": [3, 9], "high": 3, "scientif": 3, "dataset": [3, 9], "push": 3, "boundari": 3, "tradit": 3, "model": 3, "discoveri": [3, 9], "mani": 3, "larg": [3, 9], "were": 3, "softwar": [3, 9], "comput": 3, "resourc": [3, 7, 9], "scalabl": 3, "web": 3, "base": [3, 6, 9], "support": [3, 4, 6, 9], "deploy": [3, 4, 5, 6, 7], "encapsul": 3, "manag": [3, 4, 5, 6, 9], "analysi": [3, 9], "tool": [3, 9], "exploratori": 3, "research": [3, 9], "collect": [3, 8], "store": [3, 6, 7, 8], "launchabl": [3, 8], "case": 3, "architectur": 3, "compon": 3, "flow": 3, "acquir": 3, "decod": 3, "integr": [3, 9], "guid": 3, "typic": 3, "local": [3, 4, 5, 7], "oidc": [3, 7], "app": [3, 4, 6, 7, 9], "my": 3, "contributor": 3, "admin": [3, 4, 5, 6], "cluster": [3, 4, 5, 6, 7], "author": [3, 7], "membership": [3, 7], "cloud": [4, 6], "gcloud": [4, 6], "cluster_nam": 4, "zone": 4, "compute_zon": 4, "clusterrolebind": [4, 5, 6], "grep": [4, 6], "mynam": [4, 6], "bind": [4, 6], "clusterrol": [4, 5, 6], "curl": [4, 5], "githubusercont": [4, 5], "master": [4, 5], "script": [4, 5], "bash": [4, 5, 6], "kube": [4, 5], "serviceaccount": [4, 5], "tiller": [4, 5], "init": [4, 5], "stabl": [4, 6], "rbac": [4, 6], "b": 4, "class": [4, 6, 9], "dn": [4, 6], "contact": 4, "someth": 4, "project": [4, 9], "ndslab": [4, 6], "support_email": 4, "gmail": [4, 6], "smtp": [4, 6], "gmail_us": 4, "gmail_password": 4, "self": [4, 6], "cert": 4, "gener": 4, "sh": [4, 5], "past": 4, "onc": 4, "abl": 4, "www": 4, "address": [4, 6, 9], "messag": 4, "approv": 4, "deni": 4, "registr": 4, "confirm": 4, "lab": [5, 7, 9], "packag": [5, 6], "describ": [5, 6], "There": 5, "simpl": [5, 6], "approach": [5, 9], "latest": 5, "must": 5, "initi": [5, 9], "next": 5, "give": 5, "permiss": 5, "final": [5, 7], "doc": 5, "using_helm": 5, "_": 5, "minikub": 6, "kubeadm": 6, "home": [6, 7], "directori": 6, "balanc": 6, "persistentvolumeclaim": 6, "readwriteonc": 6, "etcd": 6, "sinc": 6, "gke": 6, "ll": 6, "itself": 6, "openstack": 6, "readi": 6, "email_address": 6, "outgo": 6, "And": 6, "diagram": 7, "illustr": 7, "approxim": 7, "react": 7, "redux": 7, "websocket": 7, "exec": 7, "python": [7, 9], "kubewatch": 7, "forward": 7, "specif": 7, "container": 7, "piec": 7, "simpli": 7, "uniqu": 7, "identifi": 7, "alphanumer": 7, "charact": 7, "secret": 7, "runtim": 7, "public": 7, "internet": 7, "reach": 7, "scale": 7, "while": 7, "preserv": 7, "mount": 7, "folder": 7, "present": [7, 9], "fairli": 7, "standard": 7, "those": 7, "_oauth2_proxi": 7, "arriv": 7, "anytim": 7, "userinfo": 7, "respond": 7, "todo": 7, "variou": 9, "workshop": 9, "runnabl": 9, "real": 9, "further": 9, "iassist": 9, "2016": 9, "odum": 9, "educ": 9, "institut": 9, "hand": 9, "experi": 9, "datavers": 9, "irod": 9, "cloudbrows": 9, "icat": 9, "postgresql": 9, "tworaven": 9, "held": 9, "31": 9, "27": 9, "activ": 9, "ndsc6": 9, "hack": 9, "dai": 9, "tutori": 9, "octob": 9, "19": 9, "20": 9, "phenom": 9, "2017": 9, "terra": 9, "ref": 9, "demonstr": 9, "jupyt": 9, "rstudio": 9, "analyz": 9, "cloud9": 9, "pyclowd": 9, "hyperspectr": 9, "nco": 9, "netcdf4": 9, "plantcv": 9, "jupyterlab": 9, "geospati": 9, "februari": 9, "10": 9, "53": 9, "23": 9, "univers": 9, "washington": 9, "ischool": 9, "pilot": 9, "sandbox": 9, "curat": 9, "curriculum": 9, "student": 9, "privat": 9, "dspace": 9, "ckan": 9, "fido": 9, "sql": 9, "oxygen": 9, "ei": 9, "archiv": 9, "spring": 9, "inf598h": 9, "advanc": 9, "earthcub": 9, "serv": 9, "increas": 9, "exposur": 9, "util": 9, "build": 9, "block": 9, "cinergi": 9, "suav": 9, "geodeepd": 9, "ontosoft": 9, "geow": 9, "meet": 9, "june": 9, "7": 9, "9": 9, "pi4": 9, "bootcamp": 9, "week": 9, "cours": 9, "openrefin": 9, "ran": 9, "26": 9, "30": 9, "particip": 9, "american": 9, "einstein": 9, "toolkit": 9, "school": 9, "2": 9, "evolv": 9, "ongo": 9, "august": 9, "3": 9, "4": 9, "40": 9, "thinkchicago": 9, "three": 9, "hackathon": 9, "explor": 9, "novel": 9, "citi": 9, "chicago": 9, "centric": 9, "challeng": 9, "php": 9, "postgr": 9, "200": 9, "datadrivenag": 9, "big": 9, "agricultur": 9, "cooper": 9, "globu": 9, "person": 9, "connect": 9, "postgressql": 9, "studio": 9, "xpra": 9, "openbox": 9, "fileserv": 9, "over": 9, "2tb": 9, "sampl": 9, "made": 9, "geoserv": 9, "wm": 9, "wc": 9, "wf": 9, "betydb": 9, "postgi": 9, "databas": 9, "being": 9, "launcher": 9, "broader": 9, "conclud": 9, "still": 9, "cyber": 9, "human": 9, "ecosystem": 9, "engag": 9, "secur": 9, "chees": 9, "cybersecur": 9, "lesson": 9, "plan": 9, "2019": 9, "2024": 9, "permafrost": 9, "gatewai": 9, "pdg": 9, "toolset": 9, "2022": 9, "metabolom": 9, "2021": 9, "amr": 9, "dashboard": 9, "anti": 9, "microbi": 9, "pend": 9}, "objects": {}, "objtypes": {}, "objnames": {}, "titleterms": {"admin": 0, "guid": [0, 1, 2], "tabl": [0, 1, 2], "content": [0, 1, 2], "cluster": 0, "requir": 0, "workbench": [0, 3, 6], "deploy": 0, "step": 0, "local": [0, 2], "develop": 0, "instanc": 0, "test": 0, "api": 0, "product": 0, "keycloak": 0, "configur": 0, "option": [0, 6], "author": 0, "flow": [0, 2, 7], "oidc": [0, 2], "group": 0, "membership": 0, "us": [0, 9], "an": [0, 2, 7], "extern": 0, "audienc": 0, "contributor": 1, "view": 1, "all": [1, 2], "app": [1, 2], "my": [1, 2], "catalog": 1, "user": 2, "typic": 2, "land": 2, "page": 2, "login": 2, "usernam": 2, "password": 2, "provid": 2, "e": 2, "g": 2, "cilogon": 2, "lab": [3, 6], "terminologi": [3, 8], "overview": 3, "platform": 3, "usag": 3, "quickstart": 4, "instal": [4, 6], "gke": 4, "set": [5, 6], "up": [5, 6], "helm": 5, "befor": 6, "you": 6, "start": 6, "storag": 6, "nginx": [6, 7], "ingress": 6, "control": 6, "architectur": 7, "compon": 7, "what": 7, "i": 7, "appspec": 7, "userapp": 7, "full": 7, "authent": 7, "acquir": 7, "valid": 7, "auth": 7, "token": 7, "decod": 7, "traefik": 7, "integr": 7, "case": 9}, "envversion": {"sphinx.domains.c": 3, "sphinx.domains.changeset": 1, "sphinx.domains.citation": 1, "sphinx.domains.cpp": 9, "sphinx.domains.index": 1, "sphinx.domains.javascript": 3, "sphinx.domains.math": 2, "sphinx.domains.python": 4, "sphinx.domains.rst": 2, "sphinx.domains.std": 2, "sphinx": 60}, "alltitles": {"Admin Guide": [[0, "admin-guide"]], "Table of Contents": [[0, "table-of-contents"], [1, "table-of-contents"], [2, "table-of-contents"]], "Cluster Requirements": [[0, "cluster-requirements"]], "Workbench Deployment Steps": [[0, "workbench-deployment-steps"]], "Local Development Instance": [[0, "local-development-instance"]], "Testing the Workbench API": [[0, "testing-the-workbench-api"]], "Production Deployment": [[0, "production-deployment"]], "Keycloak Configuration Options": [[0, "keycloak-configuration-options"]], "Authorization Flows": [[0, "authorization-flows"]], "Configuring OIDC": [[0, "configuring-oidc"]], "Group Membership": [[0, "group-membership"]], "Using an External Keycloak": [[0, "using-an-external-keycloak"]], "Audience": [[0, "audience"]], "Groups": [[0, "groups"]], "Contributor Guide": [[1, "contributor-guide"]], "View: All Apps": [[1, "view-all-apps"]], "View: My Apps": [[1, "view-my-apps"]], "View: My Catalog": [[1, "view-my-catalog"]], "User Guide": [[2, "user-guide"]], "Typical User Flow": [[2, "typical-user-flow"]], "Landing Page": [[2, "landing-page"]], "Login with Local Username / Password": [[2, "login-with-local-username-password"]], "Login with an OIDC Provider (e.g. CILogon)": [[2, "login-with-an-oidc-provider-e-g-cilogon"]], "All Apps": [[2, "all-apps"]], "My Apps": [[2, "my-apps"]], "Labs Workbench": [[3, "labs-workbench"]], "Terminology": [[3, "terminology"], [8, "terminology"]], "Overview": [[3, null]], "Platform Usage": [[3, null]], "Quickstart Install on GKE": [[4, "quickstart-install-on-gke"]], "Setting up Helm": [[5, "setting-up-helm"]], "Setting up Workbench": [[6, "setting-up-workbench"]], "Before you start": [[6, "before-you-start"]], "Storage Options": [[6, "storage-options"]], "Installing the NGINX Ingress Controller": [[6, "installing-the-nginx-ingress-controller"]], "Installing Labs Workbench": [[6, "installing-labs-workbench"]], "Architecture": [[7, "architecture"]], "Components": [[7, "components"]], "What is an AppSpec?": [[7, "what-is-an-appspec"]], "What is a UserApp?": [[7, "what-is-a-userapp"]], "Full Authentication Flow": [[7, "full-authentication-flow"]], "Acquiring a Valid Auth Token": [[7, "acquiring-a-valid-auth-token"]], "Decoding the Auth Token": [[7, "decoding-the-auth-token"]], "NGINX / Traefik Integrations": [[7, "nginx-traefik-integrations"]], "Use Cases": [[9, "use-cases"], [9, "id1"]]}, "indexentries": {}})
\ No newline at end of file
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+